PT-2022-22362 · Jenkins · Jenkins Rqm Plugin+1

S0Nnguy3N + 1 · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34810

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins RQM Plugin versions 2.8 and earlier

Description A missing check in the Jenkins RQM Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be done through an HTTP endpoint that does not perform a permission check, potentially allowing attackers to use the enumerated credentials IDs as part of an attack to capture the credentials using another vulnerability.

Recommendations For Jenkins RQM Plugin versions 2.8 and earlier, consider disabling the affected HTTP endpoint until a patch is available. Restrict access to the plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-34810

GHSA-2348-CCQJ-8P27

Affected Products

Jenkins

Jenkins Rqm Plugin

References · 6

• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34810 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34810 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2348-ccqj-8p27 · Vendor Advisory
• https://github.com/jenkinsci/rqm-plugin · Note
• https://t.me/cibsecurity/45450 · Telegram Post